SB2016071911 - Information disclosure in Apple Safari

Description

This security bulletin contains information about 1 vulnerability.

1) Information disclosure (CVE-ID: CVE-2016-4583)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability exists due to access control error in  Apple Safari. A remote unauthenticated attacker can obtain potentially sensitive information by creating a web site with a specially crafted SVG image that, when loaded by the target user, will access potentially sensitive image data from a different web site. 

 Successful exploitation of this vulnerability may result in disclosure of system information

Remediation

Install update from vendor's website.

References

• https://support.apple.com/en-us/HT206900
• https://support.apple.com/cs-cz/HT206902
• https://support.apple.com/cs-cz/HT206905
• https://support.apple.com/cs-cz/HT206900